From owner-freebsd-questions@freebsd.org  Tue Oct 25 13:57:57 2016
Return-Path: <owner-freebsd-questions@freebsd.org>
Delivered-To: freebsd-questions@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 8C742C21B8A
 for <freebsd-questions@mailman.ysv.freebsd.org>;
 Tue, 25 Oct 2016 13:57:57 +0000 (UTC)
 (envelope-from patfbsd@davenulle.org)
Received: from sender163-mail.zoho.com (sender163-mail.zoho.com
 [74.201.84.163])
 (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 8082EC0
 for <freebsd-questions@freebsd.org>; Tue, 25 Oct 2016 13:57:56 +0000 (UTC)
 (envelope-from patfbsd@davenulle.org)
Received: from mr185083 (mr185083.univ-rennes1.fr [129.20.185.83]) by
 mx.zohomail.com with SMTPS id 1477403864358787.427668508782;
 Tue, 25 Oct 2016 06:57:44 -0700 (PDT)
Date: Tue, 25 Oct 2016 15:57:39 +0200
From: Patrick Lamaiziere <patfbsd@davenulle.org>
To: "Simon" <simon@optinet.com>
Cc: "freebsd-questions@freebsd.org" <freebsd-questions@freebsd.org>
Subject: Re: PF - Treating Multiple Virtual IPs as one
Message-ID: <20161025155739.2d796465@mr185083>
X-Mailer: Claws Mail 3.13.2 (GTK+ 2.24.29; amd64-portbld-freebsd10.3)
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.23
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions/>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 25 Oct 2016 13:57:57 -0000

Le Mon, 24 Oct 2016 11:42:54 -0400,
"Simon" <simon@optinet.com> a écrit :

> I am trying to rate limit/control access to a port across multiple
> virtual IPs or aliases using max-src-conn and max-src-conn-rate.
> Problem arises when attacker floods connections to the same port
> across many IPs listening on the same port. Is it possible to tell PF
> to treat connections to the same port across multiple IPs assigned to
> the same NIC in the instances of max-src-conn-rate ? In other words,
> I want connections made to port XX on x.x.x.1, x.x.x.2, etc... count
> toward the same counter using max-src-conn-rate and max-src-conn. By
> default, each IP tracks own counter and this defeats the purpose of
> my rate limiting for a port. Couldn't find this in the manual.

I'm not sure but, when matched, the source track rule is associated to a
state, if several destinations are involved you have different states.
So I think you can't group the count for several destinations IP.

> Not sure if I'll have better luck with freebsd-ISP on this. Didn't
> want to cross post just yet.

there is freebsd-pf for questions about PF.

Regards,